Cybersecurity — 2026-04-14

North Koreas APT37 Deploys RokRAT Trojan via Facebook Social Engineering Campaign

ScarCruft (APT37) used two Facebook accounts geolocated to Pyongyang and Pyongsong to identify, befriend, and target victims in a multi-stage social engineering operation delivering the RokRAT remote access trojan. After building trust through Facebook Messenger, attackers pivoted to Telegram to distribute a ZIP containing a trojanized Wondershare PDFelement installer. The malware uses Zoho WorkDrive as command-and-control infrastructure for screenshot capture, remote command execution, and host reconnaissance while evading Chinese security software.

Analysis
APT37's use of Zoho WorkDrive for C2 represents a shift toward legitimate SaaS platforms that corporate firewalls cannot block without disrupting business operations, demanding behavioral detection rather than IOC-based blocking. The Facebook-to-Telegram-to-trojanized-installer kill chain reflects patience, building social trust over weeks before delivering payload, suggesting targets of sufficient intelligence value to justify the operational investment.

2 sources

North Koreas APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware - The Hacker News
APT37 Uses Facebook, Telegram, and Trojanized Installer In New Intrusion Campaign - CyberPress